Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare API Down

cloudflarestatus.com

Post reply on HN
Print view View original

141–150 of 211 posts

Re: Cloudflare API Down

#141

Post by greyface- »

ttymck wrote: post #140
hombre_fatal wrote: post #62

Earlier quoted context omitted.

You could do this with anything. X hasn't happened to me, so I bet it doesn't happen to other people, so people who take measures against X are misinformed/cargo-culting (unlike me who is conveniently the smart one in my narrative). Most services I've built that achieved any sort of traction have dealt with some sort of DoS including large fees when I've used CDNs like Cloudfront that are susceptible to a wget loop.…

> IP address spoofing is still possible today and you'll begin to realize how broken the internet has always been not that you need to have the answer to make your point, but now I am curious: what is the alternative architecture that prevents IP address spoofing? Wouldn't proving you are the IP you purport to be require some sort of authentication, which requires some centralized authority to implement? Which would…

> Which would require a fundamentally centralized internet?

Yes, that fundamentally central authority overseeing the IP address space exists today as IANA, which delegates to RIRs such as ARIN and RIPE, who allow ISPs to assert authority over address space cryptographically (RPKI) and/or in a central registry (IRR). This is the basis on which BGP announcements are typically filtered.

> what is the alternative architecture that prevents IP address spoofing?

It is possible to extend the same filtering approaches used with BGP to actual traffic forwarding without making fundamental architectural changes. See BCP38 (access) and BCP84 (peering). Widespread adoption of these would eliminate IP spoofing.

Re: Cloudflare API Down

#142

Post by esdf »

bigjoes wrote: post #76
wongarsu wrote: post #34

Earlier quoted context omitted.

You don't have to expose any ports to the internet, preventing people from finding and directly attacking your origin servers.

Only downside seems to be the Performance of tunnels in Containers. I use them for my personal Website, did a bit of Loadtesting and was able to get significantly more RPS without the CF Tunnel. Might be something on my end tho, not sure.

That's interesting. Cloudflare tunnels do a few things that I expected to to make it perform better in general: obviously TLS termination on CF's side where they likely have faster hardware doing that (at least faster than many customers), then the keep-alive sockets for tunnelCF, and I think they use UDP/QUIC for the tunnelCF connection[0] which I figure could remove some latency.

[0]: `lsof -i | grep cloudfl` shows me 4 UDP connections & 1 TCP

Re: Cloudflare API Down

#143

Post by lbriner »

I think most of us can forgive pretty much any mistake but for a service company, there are two golden rules:

1) Know that you have a problem quickly. We reported an issue yesterday and it took them 3 hours to acknowledge that there was a problem, causing us to waste hours trying to make sure nothing on our system was causing it

2) Always have a quick way to roll back changes or mitigate a problem. I think they were having some power supply issue but it is still a business risk that should have been solvable quickly.

There are certainly not the only ones but when you keep blogging about your company's technical prowess, this makes you look stupid.

Re: Cloudflare API Down

#144

Post by sanat »

dmix wrote: post #138

It's now been 12 hours and they are still having issues. I'm taking an online video course in music production and they host their videos on cloudflare stream and none of them work. https://www.cloudflare.com/products/cloudflare-stream/ The single point of failure of half the internet continues to rear it's head.

It's now 24 hours and Stream is still not up.

Re: Cloudflare API Down

#145

Post by risyachka »

msmith wrote: post #139
ebbp wrote: post #40

Earlier quoted context omitted.

In principle I agree with this, but do feel this is said more readily about Cloudflare than other companies it could said about - such as Amazon (via AWS), Google and Microsoft. Perhaps my own mental model is wrong, but I see them as a credible challenger to those very oligopolistic companies, and wish there were more Cloudflares.

I feel the same way. What about Akamai, Fastly, or Okta? Maybe Cloudflare gets more attention because their low end plans are accessible to anyone.

Its not just low end plans. Their pricing is basically the only one that feels fair. They don't charge you for bandwidth, unlike others that try to make on it as much as possible, while at the same time having other services also priced significantly higher.

Re: Cloudflare API Down

#146

Post by michaelmior »

jjav wrote: post #103
ryandvm wrote: post #37

I dunno. Cloudflare gives me the creeps. I have no idea why so many folks think large swaths of the Internet should be reliant on a single company.

> I have no idea why so many folks think large swaths of the Internet should be reliant on a single company. It's not just the reliance, but the fact that cloudflare is a MITM attacker (by design) on vast amounts of TLS traffic. TLS if used properly gives you end to end security, but if you use cloudflare they have access to all your cleartext traffic.

It's not an "attacker" by design, but certainly MITM.

Re: Cloudflare API Down

#147

Post by michaelmior »

ryandvm wrote: post #37

I dunno. Cloudflare gives me the creeps. I have no idea why so many folks think large swaths of the Internet should be reliant on a single company.

> I have no idea why so many folks think large swaths of the Internet should be reliant on a single company.

I don't think it's really that so many people think Cloudflare should be relied on. It's that Cloudflare generally has a good track record and their basic services are available for free. Actually, I don't know of any service similar to Cloudflare with such a generous free tier.

Re: Cloudflare API Down

#149

Post by michaelmior »

NicoJuicy wrote: post #117
jjav wrote: post #103

Earlier quoted context omitted.

> I have no idea why so many folks think large swaths of the Internet should be reliant on a single company. It's not just the reliance, but the fact that cloudflare is a MITM attacker (by design) on vast amounts of TLS traffic. TLS if used properly gives you end to end security, but if you use cloudflare they have access to all your cleartext traffic.

Which can be said from any cloud provider/hoster.

How so? If I'm hosting a server somewhere and clients directly connect to my server to establish a TLS connection, failing any vulnerabilities in the implementation, there's no MITM happening and the provider can't see the plaintext traffic. (Of course, since the server needs the certificate, the provider could in theory extract that certificate and establish a MITM proxy, but this isn't by design.)

Re: Cloudflare API Down

#150

Post by ilaksh »

buro9 wrote: post #46

When I worked there (3+ years ago), if PDX were out then "the brain" was out... things like DDoS protection was already being done within each PoP (so that will be just fine, even for L3 and L7 floods, even for new and novel attacks), but nearly everything else was done with the compute in PDX and then shipped to each PoP as configuration data. The lifecycle is: PoPs generate/gather data > send to PDX > compute in PD…

What is PDX?
Post reply on HN